2 issues skipped by the security teams:
- CVE-2019-20016: libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.
- CVE-2020-6860: libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/libm/libmysofa.png){kind=link}